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This Privacy Notice is published as a PDF file on the CBN website 
(https://www.cbn.gov.ng) 


Notice and Warning 


This document is the property of the Central Bank of Nigeria (CBN). It must not be 
copied or used for any other purpose other than that for which it is supplied, without 
the prior written authorization of the CBN. 


The CBN shall not be liable for any use or misuse of the document by any person and 
makes no warranty as to the accuracy or suitability of information supplied by any 
third party. Any misuse of this document may result in legal action by the CBN. 
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Introduction 


The Central Bank of Nigeria (“CBN”) is the central bank and apex monetary authority 
of Nigeria. Its regulatory objectives are as stated on its website. The CBN, therefore, 
plays a major role in the development of the Nigerian economy.. 


As a central bank and one of the financial sectors regulators, the CBN provides 
numerous services to both internal (staff and recruits) and external stakeholders within 
and outside Nigeria. The performance of these services may involve collecting and 
processing of personal data. The CBN is aware of the importance of safeguarding 
personal data which it collects in the course of executing its functions or when 
Stakeholders visit its website or uses its services. 


1.1 Privacy Notice 


This “Privacy Notice” is a public document that describes how the CBN collects, uses, 
retains and discloses the personal data of its Stakeholders in the performance of its 
functions. 


1.2 Objectives of the Privacy Notice 
The objectives of this Privacy Notice are to inform stakeholders on: 


e the type of their personal data that is being processed 
e the purpose for which their personal data is processed 
e how their personal data is processed and utilized 


1.3 The CBN’s Commitment to Data Protection 


The CBN is committed to the protection of the privacy of the personal data of its 
Stakeholders and shall ensure that the collection and utilization of such data is in 
accordance with the requirements of data protection laws and regulations. 


Stakeholders are, therefore, encouraged to read this notice carefully. 
1.4 Access to Privacy Notice 


The CBN Privacy Notice is available on its website (https://www.cbn.gov.ng) for the 
benefit of its Stakeholders. However, a detailed notice would be made available: 
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- atthe time of collection of the personal data directly from the Stakeholders 
either through the website or elsewhere 
- when the Stakeholders’ personal data is first shared with another recipient. 


1.5 Personal Data 


The automation of CBN’s business information system accentuates the need to 
safeguard personal data against unauthorized access and usage. Personal data is 
any information that can be used “directly or indirectly” to describe or identify a 
person or an individual. 


1.6 Definition of Stakeholders 
Stakeholders are those that relate with the CBN in its business activities. 
The CBN collects personal data from the following categories of Stakeholders: 


e Consultants to the CBN 

e Vendors of the CBN 

e Visitors to the CBN 

e Individuals/Customers of banks and other financial institutions (OFls) in Nigeria 
e Users of the CBN website 

Employees 

e Members of the public who provide their personal data to the CBN; and 

e whoever the CBN subsequently designates as a Stakeholder. 


1.7 Scope of the Privacy Notice 
The Privacy Notice covers the following areas: 


e Categories of personal data collected 
e Methods of collection 

e Processing methods 

e Third party relationships 

e Data retention periods 

e Changes to the Privacy Notice 

e Stakeholders consents 


1.8 Sensitive Data 


Certain categories of data have been classified as sensitive data by the Data 
Protection Regulations. The CBN may as part of its functions be required to process 
such data. Such collection and processing would be done only where necessary 
and in accordance with the relevant Data Protection laws and Regulations. 
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1.9 Purpose of collecting the personal data 


The CBN must only collect personal data for a specific, explicit and legitimate purpose. 
Personal data will not be collected in a way that is incompatible with the purpose. 


2.0 Processing of Personal Data 
2.1 Types of personal data collected from Stakeholders 


The CBN collects personal data directly from stakeholders or through any third party 
with the CBN. These personal data include: Name (in full); Address (which may 
include Town, Local Government Area, State and Country), Phone number, Login 
name/account, Password, E-mail, Religion, Age, Title, IP-address, Gender, Position 
Status/rank, Credit card number, Passport number, Driver's license number, Social 
security number, International Bank Account Number (IBAN), photograph, Health 
information, Income, Bank account number, Cookies, Biometric identifiers as well as 
others defined in applicable Data Protection Regulations. 


2.2 Grounds for collecting personal data (Consent of the stakeholder) 


The CBN shall request for consent, where required, to process the stakeholder’s data. 
Otherwise, it may process such data for the performance of a task carried out in 
public interest or in the exercise of official authority, or the performance of its legal 
obligation where in. 


A consent form would be available where necessary. However, for all visitors to its 
website, the CBN requires the Stakeholder to read and agree to the terms of the 
Privacy Notice on its website. 


The agreement/consent then becomes the legal basis to collect the personal data. 
The CBN shall use checkboxes and click wraps to obtain such consent. 


2.3 How CBN collects Personal Data 


Personal data are collected from Stakeholders in certain circumstances including 
but not limited to: 


e a transaction done with or for the CBN (e.g. an assignment, task, a project, 
supply, etc.), the details (contact information) of who did it are collected by 
the CBN 
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e Connection to the CBN domain network. the CBN automatically receives the 
Stakeholder’s Internet Protocol (IP) address which enables it to view the 
browser and the operating system the Stakeholder is using 

e Communications with the CBN via e-mails. The CBN receives the personal 
data of the Stakeholder using that e-mail 

e filing a contact form on the CBN website 

e when contract agreements with the Bank are being formalized 

e when vendors register their organizations online with the CBN 

e processing monetary claims (payments) of Stakeholders 

e when Stakeholders make telephone calls to the CBN 

e when Stakeholders application forms are being processed by the CBN 

e when a Stakeholder applies for any of the CBN’s intervention products 

e when a stakeholder requests for or applies for any of the CBN’s services 

e inthe course of recruitment and employment of staff 


2.4 How the CBN processes Personal Data 


The CBN processes Personal Data whenever it is performing any of the following 
activities: 


e Its regulatory and supervisory functions: Pursuant to its regulatory and 
supervisory functions, the CBN may process personal data for the purpose of 
developing policies, regulations and reports, assessing the financial 
soundness of banks and Other Financial Institutions, ensuring compliance 
with the Code of Corporate Governance, etc. 

e It's banking functions: The CBN may process personal data while providing 
financial services to Government, Banks, Financial Institutions, International 
bodies, etc. 

e |ts Developmental functions: The CBN may require personal data to improve 
on its services and products (e.g. intervention schemes/products) 

e Compliance with any applicable laws or regulations: The CBN may require 
personal data in order to comply with applicable laws and regulations 

e For carrying out its activities as an employer of labour: The Bank may require 
personal data for its recruitment exercise as well as for staff 

e Contractual relationships: The CBN may require personal data to enable it 
process applications from vendors and also enter into contractual 
relationships. 


If a Stakeholder does not agree to the collection/processing of his/her personal 
data by the CBN, such a stakeholder would be restricted in accessing the available 
services. 
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2.5 Posting personal data on CBN blogs 


The CBN does not encourage the posting of personal data on its blogs (short for 
weblog). This is because any personal data that is inputted can be read, 
collected, or processed by other users of the blogs. The CBN shall not be 
responsible for any personal data uploaded on its blogs. 


To request removal, kindly contact the CBN Data Protection Officer. The removal 
would be done as soon as possible. Where there are any impediments to the 
removal, the complainant would be informed accordingly. 


2.6 Use of Cookies 


The CBN website will not use cookies to collect personal data. However, the CBN can 
use cookies to: 


e improve Stakeholders’ experience on the CBN website by ensuring that the 
Stakeholder must sign in before accessing its website 

e teach the Stakeholder how to navigate the CBN website 

e recognize a Stakeholder on the CBN website and remember the Stakeholder’s 
previously selected preferences on his/her previous visits 

e collect information about a Stakeholder’s visit to the CBN website, the content 
that the Stakeholder had viewed on the website, the links that the stakeholder 
followed and information about his/her browser, device and his/her IP address 

e share some of the Stakeholder’s information with third parties 

e The “Cookies” are not used to collect personal data. They are only used to 
identify different Stakeholders on the website and to provide a better user 
experience when navigating the website. 


2.7 Visiting the CBN Website 


The CBN website does not automatically collect or store a Stakeholder’s information 
when browsing the website except the Stakeholder logs in his/her Personal Network 
Information (e.g. Internet Protocol (IP) address, web browser type, operating system of 
the computer used and other session information). The session information given is 
used by the CBN Internet Service Provider (ISP) for system administration purposes. 

It also provides the Bank with statistics on the use of its website. 


It is important to note that this Notice covers only the CBN website 
https://www.cbn.org.ng. Any other link or links within the CBN website to other 
websites or any interactions with third parties are not covered by this Privacy Notice. 
Other websites follow different rules regarding the use or disclosure of personal data 


submitted to them. You are encouraged to read the Privacy Notice of other websites 
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visited and third parties interacted with. The CBN is not responsible for the content or 
privacy practices of others. 


2.8 Status of Children 


This Privacy Notice does not cover the personal data of children under 18. If a parent 
or guardian becomes aware thot his or her child has provided the CBN with his or her 
personal data without their consent, the parent or guardian should contact the CBN 
immediately for the deletion of the data. Furthermore, if the CBN becomes aware that 
a child has provided it with his or her personal data, the CBN will delete such data 
immediately. 


2.9 Sharing of personal data (with third parties) 


It may become necessary for the CBN to share personal data with other 
organizations; in compliance with provisions of the law; to satisfy request from law 
enforcement agencies or for any other legitimate reasons. 


The CBN is obliged to comply with the data protection principles in both the National 
Information Technology Development Agency (NITDA) Data Protection Regulation 
(NDPR) and the European Union General Data Protection Regulation (EU GDPR) in 
processing of personal data. 


3.0 Legal basis for processing personal data and Stakeholders Consent 
3.1  CBN’s Legal basis for processing Personal Data 


CBN cannot process stakeholder’s personal data unless it has a specific purpose for 
doing so. Also, it would ensure that there is a legal basis for every data processing it 
does. 


The Data Protection regulations provide six legal basis for processing the personal data 
of a Stakeholder: 


e Consent: The Stakeholder has given consent to the processing of his/her 
personal data for one or more specific processing activities or purposes. He/She 
has consented to the processing activity. Consent must be freely-given, specific, 
informed and unambiguous - given by a statement or a clear, affirmative 
action. However, the CBN can process personal data without consent if it's 
necessary for a contract with the individual; for example, to supply goods or 
services they have requested; or to fulfil the CBN’s obligations under an 
employment contract 
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e Performance of a contract: The data processing activity is necessary to enter 
into or perform a contract with the Stakeholder. If the processing activity does 
not relate to the terms of the contract, then that data processing activity needs 
to be covered by a different legal basis 


Legitimate Interest: The CBN has a legitimate interest in processing the 
Stakeholder’s personal data such as providing Stakeholder support (customer 
support), Stakeholder service (customer service), agricultural services, 
research development, interventions, promoting or assisting government to 
promote some programmes and other common business interests. 

e Vital Interest: This is a rare processing activity that could be required to save 
someone's life. Failure to process the personal data would put the 
Stakeholder’s life or someone else's life at risk. It is most Commonly seen in 
emergency medical care situations. 

e Legal Requirement: Here the processing activity is necessary for a legal 
obligation. That is, the CBN is legally required to process the stakeholder’s 
personal data. 

e Public Interest — This is a processing activity that would occur by a government 
entity or an organization acting on behalf of a government entity. The CBN is 
carrying out the processing with government (a legal authority) or in the 
public interest. 


Following the above, not all aspects of personal data processing require the 
Stakeholder’s consent. 


3.2 Consent for Personal Data Processing 


The following personal data processing activities will require seeking the 
Stakeholder’s consent before processing. 


e Commencing the processing of personal data 

e Processing sensitive personal data (CBN will always tell the stakeholder why 
and how the information will be used) 

e Storing sensitive personal data 

e Sharing Stakeholders data with third parties 

e Using the CBN website and/or any of its services, the Stakeholder has agreed 
that the CBN may process his/her personal data collected (through the 
website or through the use of any of its services) in accordance with the 
provisions of the Privacy Notice. 
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3.3 Stakeholders must freely give and positively affirm their consent to processing 
their data 


Stakeholders have genuinely free choice to either give consent or not to give 
consent to the CBN (their Data Controller). If the CBN has obtained a Stakeholder’s 
consent for one type of processing, this does not mean that the CBN has obtained 
consent for all types of processing. 


3.4 Stakeholders have the right to easily withdraw their consent at any time 


Stakeholders are allowed to withdraw their consent without undue delay. The 
request to withdraw consent can be forwarded to 


dataprotectionteam@cbn.gov.ng. 


If a Stakeholder has provided consent for his/her details to be shared with a third 
party and wishes to withdraw this consent, the relevant third party should be 
contacted in order for the Stakeholder to amend his/her preferences. 


4.0 Sharing of Personal Data 


The CBN is responsible for the processing of the personal data collected or received 
and may subsequently transfer (or share) the data to an external stakeholder 
(recipient). To be able to provide services and run its’s business, the CBN may share 
data with the following categories of third parties: 


e Banks 

e Other Financial Institutions (OFIs) 

e Government 

e Ministries Departments Agencies (MDAs) 

e Law Enforcement Authorities 

e International Governments 

e International Organizations/Agencies (World Bank, IMF, WHO, etc.) 
e Others 


In some situations, the CBN may be required to disclose personal data in response 
to lawful requests by public authorities, including to comply with national security or 
law enforcement requirements. 


4.1 When is it permissible to share personal data? 


Generally, personal data will not be shared unless the stakeholder has given his or her 
consent. 


4.2 Sharing personal data with third parties 
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The CBN can, however, decide to share the personal data of her Stakeholders 
under the following circumstances amongst others: 


Where the Stakeholder has given consent, the CBN may from time to time share a 
Stakeholder’s information with other Stakeholders 


Before the CBN shares personal information, it would first enter into written 
agreement with the recipients (third parties) which will contain data protection 
terms that will safeguard the personal data of the Stakeholder. 


If the third party needs access to this data to perform their own services for the 
CBN, these third parties may have access to the Stakeholder’s personal data as 
necessary to perform their functions and they are contractually obliged to maintain 
the confidentiality of any personal data they encounter in the course of rendering 
services to the CBN. 


The CBN may share Stakeholders’ personal data with third parties to process data 
on its behalf. Here, the CBN would require that these third parties agree to process 
this data based on contractual agreements. 


The CBN may disclose your personal data to: (a) satisfy applicable law, regulations, 
legal process or valid governmental request; (o) enforce applicable Terms of 
Service, including investigation of potential violations of Terms of Service; (c) 
detect, prevent or mitigate fraud or security or technical issues; or (d) protect 
against imminent harm to the rights, property or safety of staff, its customers or the 
public as required or permitted by law. 


CBN may also disclose to third parties aggregated or other data that does not 
identify stakeholders individually. For example, how many stakeholders are eligible 
to participate in promotion examinations? 


CBN may share aggregated or anonymized data which cannot be reasonably 
used to identify stakeholders. 


CBN may share personal data between and among the various banks, OFIs, 
government, international organizations, etc. in order to carry out its functions. 


The CBN may from time to time use third parties (e.g. CBN Service Providers, 
consultants, individuals, Ministries Departments and Agencies (MDAs), EFCC, ICPC, 
FIRS, etc.) to perform/provide certain services. These third parties will have access 
to the Stakeholders’ personal data to carry out jobs assigned to them. In this case, 
they are obliged not to disclose or use the Stakeholders’ personal data for any 
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other purpose. The CBN shall include mandatory contractual provisions on data 
protection of its Stakeholders in its contracts with those third parties. 


The CBN requires all third parties to respect the security and confidentiality of 
personal data disclosed to them. 


Third parties can only process such personal data given to them for specific 
purposes and in accordance with the CBN's instruction. 


4.3  Trans-border sharing of Personal Data 


The CBN may in the course of its transactions or businesses with international 
organizations, share personal data of Stakeholders. In this situation, the CBN shall 
continue to ensure the confidentiality of personal data and give Stakeholders 
notice before their personal data is transferred to international organizations or 
becomes subject to a different Privacy Policy. CBN shall, however, comply with the 
provisions of relevant Data Protection laws regarding transfer of personal data to a 
foreign country (See Sections 2.11 and 2.12 of NITDA Guidelines). 


4.4 Compliance with the Laws and Law Enforcement Agencies 


The CBN shall cooperate with all the levels of governments and the law 
enforcement agencies to comply and enforce the provisions of the law. In this 
case, the CBN is obliged to disclose any Stakeholder’s personal data to 
government or law enforcement agencies in response to lawful requests. 


5.0 Protection of Personal Data during sharing/transmission 


5.1 Protection standards when sharing Personal Data (i.e. encrypted, clear text, 
secured, etc.) 


The safety of Stakeholders’ data is paramount to the CBN. Hence, the CBN deploys 
both physical and technological measures to protect data from unauthorized 
access both during transmission and upon receipt. However, it is important to note 
that no method of sharing/transmission over the internet or method of electronic 
storage is 100% secure. Hence, CBN cannot guarantee absolute security of any 
personal data. 


5.2 How data may be transmitted (i.e. encrypted, clear text, secured, etc.) 


The CBN shall transmit personal data using its existing infrastructure and the policy 
guiding the protection of personal data to be transmitted/shared. For further 
information please contact the dataprotectionteam@cbn.gov.ng. 
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6.0 Destruction of Personal Data 
6.1 How long CBN will keep personal data of Stakeholders 


CBN will maintain the personal data of her Stakeholders for as long as is necessary 
to fulfill the purposes for which the data is collected including satisfying any legal 
obligation, dispute resolution, enforcing agreement, and operational or reporting 
requirements. The length of time the CBN will retain the personal data will depend 
on: 


e Any legal obligations it has 

e The nature of any contracts it has in place with a Stakeholder 
e The existence of the Stakeholder’s consent 

e The CBN’s legitimate interest as a business 


6.2 How CBN will destroy Personal Data 


Where CBN does no longer need to process personal data for the purposes 
described in this Privacy Notice, it will delete the personal data from its 
system/storage. 


Also, where a Stakeholder wishes to cancel or request that the CBN no longer uses 
or maintains his/her data, he/she may contact the 
dataprotectionteam@cbn.gov.ng. 


7.0 Stakeholders’ Rights 


7.1 Stakeholders have a number of rights under the Data protection laws in 
relation to personal data held by the CBN. They include: 


e Right to be informed - about How the CBN will use the Stakeholder’s Personal 
Data 

e Right of access - Stakeholder has the right to request access to his/her Personal 
Data that the CBN is holding. This is called a subject access request. 

e Right to rectification - If the data that the CBN is holding is incorrect, the 
Stakeholder can request for correction of the inaccurate data. The Stakeholder 
should forward the accurate data while making the request. 

e Right to erasure/deletion/to be forgotten - The Stakeholder has the right to 
request the CBN to delete his/her data without undue delay. CBN will do this 
without undue delay provided that it has no compelling reason to keep it. 

e Right to restrict processing - The Stakeholder has the right to request restriction 
from processing his/her data. Request can be made for a number of reasons 
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such as if the accuracy of the personal data being processed is contested by 

the Stakeholder or the processing is unlawful. 

e Right to data portability - The Stakeholder has the right to receive his/her 
personal data from the CBN (a data controller) and transmit the same data to 
another data controller hindrance (e.g. difficulty in the structure or format of the 
data) to the new data controller. 

e Right to object - The Stakeholder has the right to object to the processing of 
his/her personal data if the processing is necessary for the purposes of the 
legitimate interests pursued by the CBN or a third party and there is something 
about the Stakeholder’s position that necessitates the objection. 

e Rights related to automated individual decision making including profiling - The 
Stakeholder has the right not to be subject to a decision based solely on 
automated processing including profiling. 

- Stakeholders can exercise these rights by calling the Data Protection Officer 
of the CBN on 07080650081 or sending an email to the dataprotection 
team@cbn.gov.ng . Such request would be dealt with as soon as 
practicable. In certain cases, the CBN would require further information 
before it can process the Stakeholder’s request. 

- In certain situations the CBN may be required by law to still hold/retain the 
personal data, or may need to retain the data in order to continue 
providing a service. 

- Furthermore, the scope of certain rights may be subject to certain 
restrictions or exceptions provided for under the Data Protection laws. 


7.2 Dispute Resolution (including remedies in the event of violation of, and any 
limitation clause to the Privacy Notice) : In the event of any dispute, controversy or 
claim arising between the CBN and its Stakeholders, the parties shall resort to 
amicable settlement within 30 business days of the dispute arising. Where this fails, the 
parties shall have recourse to mediation within 7days of deadlock, failing which they 
shall subject themselves to Arbitration in line with the Rules of Arbitration of the 
Regional Centre for International Commercial Arbitration, Lagos within 14 days of 
failure of the mediation process. Each party shall nominate one arbitrator who has 
demonstrated expertise in the field of information technology and data processing, all 
of whom would jointly nominate another arbitrator with proven expertise on 
information technology and data processing. The venue and seat of the arbitration 
shall be Nigeria and the language of arbitration shall be English. 


8.0 Confidentiality and Security 


The CBN employs industry standard security measures to ensure the security of all 


data in the CBN. Stakeholders’ Personal Data are protected by physical, electronic, 
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and procedural safeguards in compliance with applicable laws as well as further 
administrative, managerial, and technical safeguards, including firewalls and data 
encryption. 


9.0 Ensuring compliance with the Data Protection Regulations 


The CBN is a Data Controller by virtue of interpretation under the Regulation. The 
CBN’s Board of Directors through the relevant departments (Internal Audit 
Department, Banking Supervision Department, Other Financial Institutions 
Department) is responsible for compliance with the Regulation. 


The Data Protection Officer appointed by the CBN handles the day-to-day issues 
related to data protection. 


10.0 Updating this Privacy Notice 


The CBN will update this Notice as the need arises. Any such changes will be 
communicated on the CBN website (www.cbn.gov.ng). The update is effective as 
of the date written on the front page of the Privacy Notice document titled “Last 
Update”. 


11.0 Questions, Suggestions and Concerns 


If a stakeholder has issues, observations, questions, suggestions and concerns 
regarding this notice or his/her personal data, he/she should please contact the 
Data Protection Officer of the CBN via dataprotectionteam@cbn.gov.ng. 


12.0 Where this Privacy Notice will be kept 


The Privacy Notice will be hosted on the homepage of the CBN website and on its 
domain network. 


A hard copy of the Privacy Notice will also be made available on request. Such a 
request should be forwarded to: dataprotectionteam@cbn.gov.ng. 


13.0 Contact Information of the CBN 


Stakeholders can contact the CBN concerning enquiries, questions, complaints or 
suggestions about this Privacy Notice or the CBN data protection practices or how 
the CBN uses Stakeholders’ personal data by using any of the contacts below: 


e Central Bank of Nigeria, 
Attention: Data Protection Officer, 


Internal Audit Department, 
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Central Bank of Nigeria, Corporate Headquarters 
Central Business District, 


Garki - Abuja FCT, Nigeria. 


e Email ts: 


dataprotectionteam@cbn.gov.ng 


e Visiting a page on the CBN website using the link: 


httos://www.cbn.gov.n 


e Phone call using the number: 
(+234)0708065008 1 
14.0 Effective Date 


23rd June, 2020 (Date approved by Management). 


Page 15 of 16 


SS ee ee ee ee eS ee ee oo s 
Se ee ee ee ee ee ee ee ee ee ee ee ee ee ee ee ood 


m 


PAROLE ARE RELA LAEE LER ARE CBRE LAR AEE L BER ARE ERE LARP 1AB L BE (ARE BEE LURE AE L BE ARE BE LARP A L BE'S BE T BEE GEE A L BE ARE BE GEE A L BE BEE T BEE GEE A L BE ARE BEE GEE A L BE ARE BE GEE A L GB L BE BEE GEE A L BE (ASE T BEE LEST A L BE L BE BE GE LA L BE B BRE LESE A L BE S B T BEE LER A L BE L BEE ROLES LA GE L BE BEE EE LA B S BE ROLE LA B B RESELE 


lassified as Confidential 


